JOIN THE DATASPACE ================== Instructions for the person who administers the machine that is joining. You need a terminal on that machine and the ability to run sudo. Nothing else. You should also have been given a one-time TOKEN. If you have not, ask whoever sent you this link — nothing below works without it. BEFORE YOU START — 30 seconds ----------------------------- Run this. It only looks; it changes nothing: curl -fsSL https://join.eu-begonia.org/preflight.sh | sh It prints OK or tells you exactly what is missing. If everything is OK, carry on. You need only: root/sudo, curl, python3, and outbound network access to * dc-hub.duckdns.org UDP port 51820 (the tunnel) * https://join.eu-begonia.org TCP 443 (this site) If your firewall is closed by default, those are the two rules to open. Nothing needs to be opened INBOUND — see "What we can reach" below. Everything else is INSTALLED FOR YOU by the script in step 3 — WireGuard and podman (the container runtime your connector runs in). You do not need to prepare the machine, and the join will not stop half way to ask for something. Supported package managers: apt, dnf, yum, zypper, apk, pacman. STEP 1 — download the script and check it is the real one --------------------------------------------------------- curl -fsSL https://join.eu-begonia.org/join.sh -o join_dataspace.sh chmod +x join_dataspace.sh Now verify it matches what we published. This one command prints a verdict, so you do not have to compare long strings by eye: [ "$(sha256sum join_dataspace.sh | cut -d" " -f1)" = "$(curl -s https://join.eu-begonia.org/bootstrap.sha256 | sed 's/.*"sha256": "//;s/".*//')" ] && echo "OK - genuine" || echo "STOP - does not match, do not run it" If it says STOP, do not continue. Tell the person who sent you the link. STEP 2 — look at what it would do (optional, changes nothing) ------------------------------------------------------------- ./join_dataspace.sh --token YOUR-TOKEN --site your-site-id --country XX --dry-run This needs no sudo and touches nothing. It prints the exact information that would be sent to us, so you can see it before agreeing to it. If you want to read the script itself: `less join_dataspace.sh` (press q to quit). STEP 3 — run it --------------- sudo ./join_dataspace.sh --token YOUR-TOKEN --site your-site-id --country XX Replace the three values (no angle brackets, no quotes needed): YOUR-TOKEN the token you were given your-site-id a short name for this machine: lowercase letters, digits and dashes, 3-24 characters. Example: partner-madrid XX your 2-letter country code. Example: ES Optional: --label "Partner DMZ Madrid" --contact ops@your-company.example It takes a few minutes. WHEN IT WORKS you will see, at the end: == 5/5 fetching the agent over the tunnel agent installed in /opt/uc3-agent: ... == handing over to the agent - it finishes on its own from here This machine is now: site id your-site-id (XX) overlay 172.20.50.x -> hub 172.20.50.1 If you see that, you are done. There is nothing else to do. IF SOMETHING GOES WRONG ----------------------- "Permission denied" you skipped `chmod +x` in step 1. "--token is required" put your token after --token. "could not reach ..." outbound HTTPS to this site is blocked. "could not bring up uc3wg0" outbound UDP to dc-hub.duckdns.org:51820 is blocked. "enrollment refused" the token is used up or expired — ask for a new one. "no supported package manager" your distribution is not one of apt/dnf/yum/ zypper/apk/pacman — install wireguard-tools and podman yourself, then re-run. "could not install podman" the package manager refused; the message names the exact command to run by hand. Anything else: send the output to whoever gave you the token. To undo everything at any point: sudo ./join_dataspace.sh --uninstall WHAT THE SCRIPT DOES ON YOUR MACHINE ------------------------------------ 1. installs anything missing, up front and in one go: WireGuard, podman, and curl/python3 if they are somehow absent (apt/dnf/yum/zypper/apk/pacman) 2. creates a WireGuard key pair. THE PRIVATE KEY NEVER LEAVES THIS MACHINE. Only the public half is sent to us. 3. contacts us once over HTTPS, sending: your site id, country, that public key, and basic facts about the machine (hostname, CPU count, architecture). No credentials, no keys, none of your data. 4. brings up an OUTBOUND-ONLY tunnel on its own interface, uc3wg0. If you already use wg0, it is not touched. NO INBOUND FIREWALL RULE IS NEEDED. 5. downloads a small agent over that tunnel and runs it. The agent sets your connector up and then works on its own; it does not contact us again. WHAT WE CAN REACH ON YOUR SIDE AFTERWARDS ----------------------------------------- Only what you choose to route over uc3wg0 — a single address we allocated to you. We never dial into your network and we have no account on your machine. OFFERING A SERVICE (later, when you are ready) ---------------------------------------------- The agent leaves a form at /etc/uc3/services/ for you to fill in. Then: sudo uc3-agent validate # checks it and names any problem, field by field sudo uc3-agent publish # your own connector advertises it That file is not sent anywhere by itself — your connector advertises it and the dataspace discovers it from there. To check on things at any time: sudo uc3-agent status · sudo wg show uc3wg0 A NOTE ON TRUST --------------- We deliberately do not ask you to pipe a script from the internet straight into a shell. You are being asked to run someone else's code as root inside your own perimeter. Download it, check the digest, look at it, and only then run it.